Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
41 detections
Filters
Last updated
All Time
Detection languages
15
10
10
3
2
Contributors
36
5
Categories
36
23
19
10
5
Platforms
32
9
5
1
1
Products / Services
28
12
7
4
3
MITRE Techniques
29
25
16
15
7
CVEs
68
68
63
58
50
41
Detects anomalous activity associated with the exploitation of RustDesk session permission bypass vulnerabilities. Specifically identifies 'rustdesk.exe' spawning suspicious child processes (indicative of post-exploitation command execution) or initiating outbound network connections on non-standard relay ports, which may signal a compromised remote access session.
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects potential exploitation of RustDesk remote access software, focusing on unauthorized process execution from RustDesk-related binaries (including session relay and rendezvous components) and the presence of documented proof-of-concept (PoC) artifacts associated with session permission bypass vulnerabilities.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
This rule detects potential exploitation of a privilege escalation vulnerability (identified as CVE-2026-46331) involving the manipulation of Linux Traffic Control (tc) pedit actions or user/network namespace unsharing shortly after a setuid binary execution or root shell spawn. This behavior is indicative of a 'Copy-on-Write' (COW) or similar kernel-level vulnerability exploitation chain where unprivileged users abuse system features to gain elevated privileges.
Detects high-risk child processes spawned by 7-Zip (7z.exe, 7zG.exe, 7zFM.exe) when extracting files. This rule is designed to identify potential exploitation of CVE-2026-46331, where 7-Zip fails to properly propagate the Zone.Identifier alternate data stream (Mark-of-the-Web) from RAR5 archives, effectively bypassing SmartScreen security warnings for extracted executables or scripts.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects the execution of 'unshare' with flags (such as --user/--net or CLONE_NEWUSER/CLONE_NEWNET) by unprivileged users. This behavior is indicative of attempts to gain CAP_NET_ADMIN capabilities within a new namespace, a necessary precursor to exploiting the pedit COW (CVE-2026-46331) vulnerability for privilege escalation.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.
Detects unauthorized shells (bash, sh, dash, zsh) spawned as root from common setuid binaries (su, sudo, newgrp) by an unprivileged user. This behavior is indicative of the CVE-2026-46331 'pedit COW' vulnerability, where a local attacker performs page cache poisoning on a setuid binary to execute arbitrary code as root without disk modification.
Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.
Detects the execution of known exploit binaries or the compilation of source files associated with the Linux PACKET_EDIT_MEME exploit (CVE-2026-46331). The rule monitors for specific binary names associated with the exploit, execution of these binaries from common staging directories (/tmp, /dev/shm, /run), and the use of GCC or CC compilers to build the exploit source files.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Detects the execution of a /bin/sh root shell initiated by /bin/su where the parent process indicates a non-root context. This pattern is characteristic of CVE-2026-46331, where an attacker exploits the page cache (pedit COW) to inject shellcode into the in-memory cached /bin/su binary, effectively gaining root privileges without on-disk modification.
Detects 7-Zip (7z.exe / 7zG.exe) writing executable files to user-accessible directories, potentially leveraging CVE-2026-46331. This vulnerability allows an adversary to manipulate the Zone.Identifier Alternate Data Stream (ADS) of extracted files by embedding a crafted RAR5 stream, effectively setting the ZoneId to 0 (My Computer) and bypassing Windows SmartScreen warnings upon subsequent execution.
Detects exploitation attempts against Gitea instances where an attacker impersonates an admin user by injecting the 'X-WEBAUTH-USER' header. This vulnerability typically occurs when 'REVERSE_PROXY_TRUSTED_PROXIES' is misconfigured to trust all proxies ('*'), allowing unauthenticated users to gain administrative access via header manipulation. The rule covers web request headers, container logs for suspicious admin creation, and process execution arguments associated with the exploitation.
Page 1 of 2